Paginator maxLimit clamping behavior when clients request oversized page sizes

Paginator Clamping Behavior

In CakePHP 4.x and 5.x, the Paginator component implements silent clamping. If a client requests a limit via query parameters that exceeds the defined maxLimit, the framework automatically reduces the limit to the maxLimit value before executing the query. There is no built-in signal, exception, or metadata flag in the paging object to notify the client that their requested limit was capped; the response simply contains the maximum allowed number of records.

Default Caps and Configuration

When maxLimit is not explicitly configured in your controller or global settings, CakePHP typically defaults to a cap of 100. This prevents accidental or malicious requests from triggering unbounded result sets that could exhaust server memory.

Merging Controller Defaults with Per-Call Options

Options passed directly to the paginate() method are merged with the controller-level $paginate property. This merge happens on a per-key basis, meaning method-level options take precedence over property-level defaults. For example, if your controller defines a maxLimit of 50, but you pass ['maxLimit' => 100] into the paginate() call, the limit for that specific request will be 100.

Verification Steps

To confirm this behavior in your specific environment, you can use the following tests:

• Verify Default Cap: Request ?limit=1000 on an endpoint where maxLimit is unset. Inspect the resulting Paging object or the executed SQL LIMIT clause to confirm it is capped at 100.
• Verify Merge Precedence: Set $this->paginate = ['limit' => 10]; in your controller, then call $this->paginate(['limit' => 20]);. The resulting page size should be 20.
• Verify Clamping: Set maxLimit to 25 and request ?limit=50. The result set should contain exactly 25 records.

Diagnostic Note: Are you using a custom Paging class or a modified Paginator component? Custom implementations may override the default clamping logic or the standard 100-record cap.